Binance Reports $3.64 Billion Net Outflow in First Day of Reopened Withdrawals, as Circle's Freeze Reaches $1.1 Billion

Since attackers drained roughly $6.3 billion from Binance on Oct. 29, the exchange has put its own figures on how many customers headed for the exits when withdrawals reopened on Sunday, Nov. 1.

Between 6 a.m. and 3:30 p.m. UTC, Binance said, it processed $4.65 billion in withdrawals and $1.01 billion in deposits. That is a net outflow of $3.64 billion, which the exchange put at 2.1% of the $171 billion in assets shown in its Oct. 28 proof-of-reserves data.

The figure covers a fixed window of about nine and a half hours, not a full day, and that window does not establish whether withdrawals will continue at the same pace.

Different windows, different totals

Outside trackers show a bigger number over a longer period. DefiLlama data showed about $5.8 billion in net outflows over a 24-hour span. An earlier DefiLlama reading put the figure at about $4.05 billion for the 24 hours ending around 11:14 a.m. Eastern on Nov. 1. Those windows started before Binance's reopening and are not the same measurement as the company's.

During the earlier DefiLlama window, rival exchange OKX recorded about $316.8 million in net inflows. Blockchain flows alone cannot show why individual customers moved money.

Binance said withdrawal volumes spiked early and then declined and stabilized, while deposits stayed substantial. The largest share of withdrawals was in USDT, followed by USDC and bitcoin. Withdrawals were restored across all 15 networks in the initial phase by 12:36 p.m. UTC. Binance said it is still testing the remaining networks and assets, and has not yet announced the next phase.

Freezes and the repayment effort

Circle said it activated incident response procedures and coordinated with law enforcement to freeze more than $1.1 billion in USDC tied to the incident. CEO Jeremy Allaire had said on Friday the figure was more than $800 million. Circle said its investigation is ongoing. Tether CEO Paolo Ardoino said earlier that his company froze more than 1.567 billion USDT.

Binance said it has now replaced about 95% of the affected assets, up from 90% in its previous update. The company said the last 5% is made up of less liquid tokens that will take longer to buy in the needed size. Binance has said it will absorb the loss and not pass it on to users. It said it has set aside more than $6.34 billion from its corporate treasury, its SAFU user-protection fund and a futures insurance fund.

Replacing assets is not the same as recovering them. Binance may replace missing holdings without retrieving the original funds. In its initial disclosure, the company said about $3 billion had been frozen on-chain, leaving roughly half the estimated total still out there. Chainalysis said it was watching funds shift across multiple blockchains, including bitcoin and ethereum.

North Korea attribution, and the president's doubt

The FBI said in a statement that North Korea was responsible for the theft of more than $6 billion in virtual assets, and named the TraderTraitor group. The agency said it observed those actors converting the stolen assets into Ethereum and expects them to launder the money through decentralized finance platforms and instant swap services. It urged private firms to block transactions involving the addresses the hackers are using. TraderTraitor is the group blamed for the $1.5 billion Bybit theft in February last year.

President Trump publicly questioned that conclusion. "I'm not concerned. We're learning about it. We don't know if it's North Korea," he told reporters in Florida late Saturday. The FBI has put the attribution in writing.

Binance's early account of the breach pointed to a compromised DevOps engineer's laptop, which allowed access to a service container and unauthorized withdrawal transactions. The company said it found no evidence of a wallet private key leak. It has promised a detailed technical post-mortem once the facts are verified.

Confidence: modest outflow, wider worry

CZ, Binance's founder and former CEO, who remains a shareholder, framed the numbers as a win. "98% choose to stay!" he wrote on X, adding that most outflows came in the first couple of hours. "Trust isn't earned by what you say in good times. It's earned by what you do in hard times."

Analysts quoted by Reuters called the outflow fairly modest. Tim Sun, a senior researcher at HashKey Group in Hong Kong, said the episode "has not yet triggered widespread panic or a massive, concentrated withdrawal." He added that the damage to confidence "likely extends far beyond the stolen assets," and that security concerns will affect how much market makers, institutions and other investors allocate to the sector.

Some users are not waiting on that debate. Ryan Tan, a 39-year-old Binance user, told Reuters he has kept his holdings in his own wallet since FTX collapsed four years ago. Jay Koh of the Asia Web3 AI Association said he would not necessarily pull everything out, because centralized exchanges still matter for liquidity and market access.

Bitcoin hit a six-week low on Friday, then recovered over the weekend to trade above $78,000 on Monday. Ether also rose from a two-month low. Stablecoin market capitalizations have fallen since Friday.

Co-CEO Yi He said on X Monday that the priority is making sure the environment is secure before users withdraw funds and operations resume. Binance took a new proof-of-reserves snapshot at 00:00 UTC on Oct. 31, with zero-knowledge proof calculations underway, and said the updated report is expected to be published Nov. 2. That report will provide additional information about the exchange's reserve position after the attack and the first day of withdrawals.